Attacks and Exploits is 35 percent of the PT0-003 exam. No other domain comes within 14 points of it. That one number should drive your entire study calendar, and most candidates find it out three weeks in, after they have already spent that time on scoping documents and report structure.
PT0-003 is the current version of CompTIA PenTest+. It launched December 17, 2024, and PT0-002 retired on June 17, 2025. If the study guide on your shelf lists five domains ending in Tools and Code Analysis, it is testing a blueprint that no longer exists. The restructure was more than cosmetic, and this guide walks the actual domains, the performance-based questions, the version differences, and a study sequence that matches how the exam is built.
PT0-003 gives you five more questions than PT0-002 did in the same 165 minutes. Pacing is now part of the exam.
What Is CompTIA PenTest+ and Who Is PT0-003 For?
PenTest+ is CompTIA’s offensive security certification. It validates that you can plan and scope an engagement inside legal constraints, run reconnaissance and enumeration, discover and validate vulnerabilities, execute attacks across network, host, web application, and cloud targets, maintain access and move laterally, and then write findings that someone can act on. CompTIA recommends three to four years in a penetration tester role, with Network+ and Security+ knowledge or the equivalent, before you sit it.
Treat that recommendation as real. The certification sits at the intermediate tier of CompTIA’s cybersecurity pathway alongside CySA+, one level above Security+, and the question set assumes you have run tools against real targets rather than read about them. Candidates who come straight from Security+ with no lab time behind them fail this exam, and they usually fail it on the performance-based questions rather than the multiple choice.
The candidates who do well tend to fall into three roles. Junior and mid-level penetration testers who need a credential their employer recognizes. Security analysts crossing from defense to offense, who already understand the attack chain from the detection side and need to learn to execute it. Consultants and contractors who need a vendor-neutral qualification that a contracting officer or a client procurement team will accept. If none of those describe your work, look at what a pen test actually involves before committing, because our breakdown of penetration testing as a discipline covers ground this exam assumes you already have.
PT0-003 Exam Format, Cost, and Passing Score
Maximum of 90 questions, 165 minutes, a mix of multiple-choice and performance-based items, and a passing score of 750 on a scale from 100 to 900. The exam is offered in English, French, Japanese, and Portuguese, and it is delivered through Pearson VUE either at a test center or online with a proctor.
Budget past the voucher. Between an exam attempt, practice material, and lab access, most self-study candidates land somewhere between $600 and $1,200 before any instructor-led training enters the picture. Our guide to saving money on CompTIA vouchers covers the discount paths that are actually legitimate, including academic and military pricing.
What Are the Five PT0-003 Domains and Their Weights?
Domain 2 rewards preparation more than any other section, because enumeration is where a methodical candidate separates from a lucky one. Knowing which Nmap flag produces which result under which condition is a small body of knowledge with an outsized return on this exam, and it carries directly into the performance-based questions. Working through Nmap scan types and when each one applies is a reasonable first week of study.
What Changed From PT0-002 to PT0-003?
CompTIA rebuilt the domain structure around the phases of an engagement instead of around subject categories. Reporting is no longer a standalone domain, and neither is tooling.
Dissolving the tools domain is the change candidates underestimate. Under PT0-002 you could memorize a tool list and pick up points on recognition questions. PT0-003 asks you to select the right tool inside a scenario, which means recognizing the name is worth nothing unless you know what output it produces and what you would do with that output next. Post-exploitation also gained standing as its own 14 percent domain, so persistence, lateral movement, and cleanup are no longer footnotes buried inside a larger attacks section.
The AI objective is small and specific. Domain 4 lists AI attacks as explaining prompt injection and model manipulation. Explaining, not executing. Candidates see AI on an objectives list and assume they need adversarial machine learning depth. They need to be able to describe how an injected instruction subverts a model’s intended behavior and how manipulated training or input data changes its output. An afternoon of reading covers it.
How Hard Are the PenTest+ Performance-Based Questions?
Hard enough that they decide most failures. PBQs on PT0-003 put you in front of scan output, a code or script sample, or a simulated interface and ask you to interpret, correct, or sequence something. Reading comprehension under a clock is the actual skill being measured, and it does not respond to flashcards.
Three habits help. Skip every PBQ on your first pass through the exam and flag it, then return once the multiple choice is done and you know how much time you have left. Read the entire prompt before touching anything, since PBQs frequently ask for one specific deliverable and a candidate who starts working immediately will solve a problem that was not asked. And when a PBQ presents a script, identify what the script is trying to accomplish before you look for the flaw, because the flaw is almost always a mismatch between intent and implementation rather than a syntax error. The same PBQ discipline applies across the CompTIA line, and the approach in our Linux+ XK0-006 guide transfers cleanly.
Scoring is weighted, so a PBQ is worth more than a multiple choice item. Guessing on one costs you more than guessing on four multiple choice questions, which is why the time you protect for them matters.
PenTest+ vs CySA+: Which Should You Take First?
Take the one that matches the job you want next, because CompTIA places them at the same tier and neither is a prerequisite for the other. PenTest+ is offensive and CySA+ is defensive, both cost $439, and both require 60 CEUs to renew. Neither one renews the other, which is the detail that surprises people who assumed stacking them would simplify maintenance.
Either one renews Security+, Network+, and A+ underneath it, so passing PenTest+ resets the clock on everything below it in the hierarchy. For someone holding three CompTIA certifications with mismatched expiration dates, timing PenTest+ before the earliest of them expires is worth real money. A useful comparison is the difference between offensive testing and assessment work generally, which our piece on security audits versus penetration tests lays out.
Does PenTest+ Count for DoD 8140?
PenTest+ appears in the DoD 8140 qualification matrix, but qualification is assigned by DCWF work role and proficiency level rather than by certification. A credential that satisfies one work role at an intermediate level may not satisfy a different role, or the same role at an advanced level. There is no certification under DoDM 8140.03 that covers a person generally.
Get your work role code from your position description and check it against the current matrix on the DoD Cyber Exchange before you spend anything. The matrix is revised periodically. Our DCWF work role map explains how to read that document without guessing.
How to Study for the PT0-003 Exam
Download the official PT0-003 objectives and use them as a checklist rather than as reading material. CompTIA writes questions against those bullets, and every tool named in the document is fair game. Any objective you cannot demonstrate in a lab is a gap, not a weak area.
Build a lab before you buy study material
A laptop with 16 GB of RAM running a hypervisor is enough. Put an attack platform on one virtual machine and intentionally vulnerable targets on two or three others. Run the full sequence against your own targets rather than following a walkthrough. Enumerate the host, identify the service, find the weakness, exploit it, escalate, establish persistence, move to a second host, and then write two paragraphs describing what you did and what you would recommend to fix it. That last step is the one everyone skips, and it is worth 13 percent of the exam.
Weight your calendar to the blueprint
Give Attacks and Exploits roughly a third of your total study time, matching its 35 percent weight, and split that across the five attack categories rather than going deep on the one you find interesting. Web application and cloud attacks are where candidates from a traditional network background lose the most points, particularly container escapes, metadata service attacks, and identity misconfiguration in cloud environments. Reconnaissance and enumeration deserve the next largest block at roughly a fifth. Engagement management needs the least time but should not be skipped, because it is the domain where a well prepared candidate can bank near-perfect scoring on material that rewards careful reading. Post-exploitation deserves a dedicated block of its own rather than being treated as the tail end of exploitation practice, since it now stands as a separate 14 percent domain. Vulnerability discovery sits in the middle and mostly comes down to interpreting scanner output and ruling out false positives, which is faster to learn than the attack content but easy to neglect. Build the schedule backward from your test date and put the heaviest domains earliest, so the material you learned first gets the most repetition. Most candidates with hands-on experience need eight to twelve weeks at ten hours a week. Someone coming straight from Security+ should plan closer to four months and expect lab time to dominate that calendar. Whatever the total, reserve the final two weeks for timed practice rather than new material.
Practice tests measure readiness, they do not create it
Use them in the last three weeks, timed, under exam conditions, and review every question you got right for the wrong reason. Scoring consistently in the mid-80s on quality practice material is a reasonable readiness signal. A perfect score means the material is too easy or you have memorized the bank, and neither of those predicts a pass. Exam dumps violate the CompTIA candidate agreement and can get a certification revoked, which is a poor trade for a $439 exam.
Candidates who want the compressed version with lab infrastructure already built can look at our PenTest+ boot camp, though self-study works for this exam if you have the discipline to build the lab yourself.
Frequently Asked Questions About PenTest+ PT0-003
How much does the PenTest+ PT0-003 exam cost?
The US retail price is $439 following CompTIA’s June 1, 2026 increase, up from $425. Authorized training partners commonly sell the same voucher at 10 to 15 percent below list, and academic and military pricing runs lower still.
What is a passing score on PenTest+?
You need 750 on a scale of 100 to 900. That is a scaled score rather than a percentage, so it does not correspond to a fixed number of correct answers, and performance-based questions carry more weight than multiple choice items.
Is PT0-002 still valid?
The PT0-002 exam retired on June 17, 2025 and can no longer be taken. A PenTest+ certification earned through PT0-002 stays active until its own three year expiration date, and it renews through the CompTIA Continuing Education program the same way a PT0-003 certification does.
Do I need Security+ before PenTest+?
Security+ is not a formal prerequisite. CompTIA recommends Network+ and Security+ knowledge plus three to four years in a penetration tester role, and the exam is written against that assumption, so skipping the foundational material generally costs more in study time than it saves in exam fees.
How many CEUs does PenTest+ require to renew?
PenTest+ requires 60 CEUs across a three year cycle plus the annual continuing education fee, and there is no single-activity CertMaster CE option at this tier. Passing SecurityX renews it outright, and passing PenTest+ renews Security+, Network+, and A+ underneath it.
When will PT0-003 retire?
CompTIA estimates 2027, based on its practice of retiring an exam version roughly three years after launch. Previous exams have stayed available for about six months after the successor launches, so a candidate testing in 2026 has no timing risk.
Does PenTest+ cover AI attacks?
Domain 4 includes AI attacks, specifically explaining prompt injection and model manipulation against artificial intelligence systems. The objective asks for explanation rather than execution, so it represents a small share of the domain and does not require adversarial machine learning expertise.
Director, Educational Services | Training Camp
Mark Sabo is the Director of Educational Services at Training Camp, where he oversees the training team, course design, and certification program development. He holds a B.S. in Information Sciences and Technology from Penn State University and more than 50 industry certifications. Mark joined Training Camp in 2005, became a Technical Trainer in 2007, and assumed his current leadership role in 2015. His specialty is practice exam development and exam preparation strategy, built from years of teaching students in the classroom and studying how certification exams are constructed. His writing focuses on the technical details that matter most to professionals preparing for high stakes exams.